Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package git for openSUSE:Factory checked in at 2025-07-10 23:14:51 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/git (Old) and /work/SRC/openSUSE:Factory/.git.new.7373 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "git" Thu Jul 10 23:14:51 2025 rev:325 rq:1291488 version:2.50.1 Changes: -------- --- /work/SRC/openSUSE:Factory/git/git.changes 2025-06-27 23:00:46.899961037 +0200 +++ /work/SRC/openSUSE:Factory/.git.new.7373/git.changes 2025-07-10 23:14:53.892163641 +0200 @@ -1,0 +2,78 @@ +Wed Jul 9 11:01:47 UTC 2025 - Marcus Rueckert <mrueck...@suse.de> + +- refreshed gitk sha256 patches: + 0001-gitk-Add-support-of-SHA256-repo.patch + 0002-git-gui-Add-support-of-SHA256-repo.patch + +------------------------------------------------------------------- +Wed Jul 9 10:48:56 UTC 2025 - Marcus Rueckert <mrueck...@suse.de> + +- update to 2.50.1 (boo#1245938 boo#1245939 boo#1245942 boo#1245943 + boo#1245946 boo#1245947) + Security fixes for CVE-2025-27613, CVE-2025-27614, + CVE-2025-46334, CVE-2025-46835, CVE-2025-48384, CVE-2025-48385, + and CVE-2025-48386 + + CVE-2025-27613, Gitk: + + When a user clones an untrusted repository and runs Gitk without + additional command arguments, any writable file can be created and + truncated. The option "Support per-file encoding" must have been + enabled. The operation "Show origin of this line" is affected as + well, regardless of the option being enabled or not. + + CVE-2025-27614, Gitk: + + A Git repository can be crafted in such a way that a user who has + cloned the repository can be tricked into running any script + supplied by the attacker by invoking `gitk filename`, where + `filename` has a particular structure. + + CVE-2025-46334, Git GUI (Windows only): + + A malicious repository can ship versions of sh.exe or typical + textconv filter programs such as astextplain. On Windows, path + lookup can find such executables in the worktree. These programs + are invoked when the user selects "Git Bash" or "Browse Files" from + the menu. + + CVE-2025-46835, Git GUI: + + When a user clones an untrusted repository and is tricked into + editing a file located in a maliciously named directory in the + repository, then Git GUI can create and overwrite any writable + file. + + CVE-2025-48384, Git: + + When reading a config value, Git strips any trailing carriage + return and line feed (CRLF). When writing a config entry, values + with a trailing CR are not quoted, causing the CR to be lost when + the config is later read. When initializing a submodule, if the + submodule path contains a trailing CR, the altered path is read + resulting in the submodule being checked out to an incorrect + location. If a symlink exists that points the altered path to the + submodule hooks directory, and the submodule contains an executable + post-checkout hook, the script may be unintentionally executed + after checkout. + + CVE-2025-48385, Git: + + When cloning a repository Git knows to optionally fetch a bundle + advertised by the remote server, which allows the server-side to + offload parts of the clone to a CDN. The Git client does not + perform sufficient validation of the advertised bundles, which + allows the remote side to perform protocol injection. + This protocol injection can cause the client to write the fetched + bundle to a location controlled by the adversary. The fetched + content is fully controlled by the server, which can in the worst + case lead to arbitrary code execution. + CVE-2025-48386, Git: + + The wincred credential helper uses a static buffer (`target`) as a + unique key for storing and comparing against internal storage. This + credential helper does not properly bounds check the available + space remaining in the buffer before appending to it with + `wcsncat()`, leading to potential buffer overflows. + +------------------------------------------------------------------- Old: ---- git-2.50.0.tar.sign git-2.50.0.tar.xz New: ---- git-2.50.1.tar.sign git-2.50.1.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ git.spec ++++++ --- /var/tmp/diff_new_pack.pzPDY1/_old 2025-07-10 23:14:57.196301184 +0200 +++ /var/tmp/diff_new_pack.pzPDY1/_new 2025-07-10 23:14:57.208301684 +0200 @@ -43,7 +43,7 @@ %bcond_with asciidoctor %endif Name: git -Version: 2.50.0 +Version: 2.50.1 Release: 0 Summary: Fast, scalable, distributed revision control system License: GPL-2.0-only ++++++ 0001-gitk-Add-support-of-SHA256-repo.patch ++++++ --- /var/tmp/diff_new_pack.pzPDY1/_old 2025-07-10 23:14:57.408310015 +0200 +++ /var/tmp/diff_new_pack.pzPDY1/_new 2025-07-10 23:14:57.432311015 +0200 @@ -37,11 +37,11 @@ gitk-git/gitk | 83 +++++++++++++++++++++++++++++++++++---------------- 1 file changed, 58 insertions(+), 25 deletions(-) -diff --git a/gitk-git/gitk b/gitk-git/gitk -index 19689765cde5..04f5f5face68 100755 ---- a/gitk-git/gitk -+++ b/gitk-git/gitk -@@ -394,6 +394,7 @@ proc parseviewargs {n arglist} { +Index: git/gitk-git/gitk +=================================================================== +--- git.orig/gitk-git/gitk ++++ git/gitk-git/gitk +@@ -479,6 +479,7 @@ proc parseviewargs {n arglist} { proc parseviewrevs {view revs} { global vposids vnegids @@ -49,7 +49,7 @@ if {$revs eq {}} { set revs HEAD -@@ -407,7 +408,7 @@ proc parseviewrevs {view revs} { +@@ -492,7 +493,7 @@ proc parseviewrevs {view revs} { set badrev {} for {set l 0} {$l < [llength $errlines]} {incr l} { set line [lindex $errlines $l] @@ -58,7 +58,7 @@ if {[string match "fatal:*" $line]} { if {[string match "fatal: ambiguous argument*" $line] && $badrev ne {}} { -@@ -624,6 +625,7 @@ proc updatecommits {} { +@@ -698,6 +699,7 @@ proc updatecommits {} { global hasworktree global varcid vposids vnegids vflags vrevs global show_notes @@ -66,7 +66,7 @@ set hasworktree [hasworktree] rereadrefs -@@ -657,7 +659,7 @@ proc updatecommits {} { +@@ -731,7 +733,7 @@ proc updatecommits {} { # take out positive refs that we asked for before or # that we have already seen foreach rev $revs { @@ -75,7 +75,7 @@ if {[lsearch -exact $oldpos $rev] < 0 && ![info exists varcid($view,$rev)]} { lappend newrevs $rev -@@ -1542,6 +1544,7 @@ proc getcommitlines {fd inst view updating} { +@@ -1614,6 +1616,7 @@ proc getcommitlines {fd inst view updati global parents children curview hlview global idpending ordertok global varccommits varcid varctok vtokmod vfilelimit vshortids @@ -83,7 +83,7 @@ set stuff [read $fd 500000] # git log doesn't terminate the last commit with a null... -@@ -1624,7 +1627,7 @@ proc getcommitlines {fd inst view updating} { +@@ -1696,7 +1699,7 @@ proc getcommitlines {fd inst view updati } set ok 1 foreach id $ids { @@ -92,7 +92,7 @@ set ok 0 break } -@@ -1870,8 +1873,8 @@ proc getcommit {id} { +@@ -1942,8 +1945,8 @@ proc getcommit {id} { return 1 } @@ -103,7 +103,7 @@ # This is fairly slow... proc longid {prefix} { global varcid curview vshortids -@@ -1904,6 +1907,7 @@ proc readrefs {} { +@@ -1976,6 +1979,7 @@ proc readrefs {} { global selecthead selectheadid global hideremotes global tclencoding @@ -111,7 +111,7 @@ foreach v {tagids idtags headids idheads otherrefids idotherrefs} { unset -nocomplain $v -@@ -1913,9 +1917,9 @@ proc readrefs {} { +@@ -1985,9 +1989,9 @@ proc readrefs {} { fconfigure $refd -encoding $tclencoding } while {[gets $refd line] >= 0} { @@ -124,7 +124,7 @@ if {![string match "refs/*" $ref]} continue set name [string range $ref 5 end] if {[string match "remotes/*" $name]} { -@@ -2210,6 +2214,7 @@ proc makewindow {} { +@@ -2282,6 +2286,7 @@ proc makewindow {} { global have_tk85 have_tk86 use_ttk NS global git_version global worddiff @@ -132,7 +132,7 @@ # The "mc" arguments here are purely so that xgettext # sees the following string as needing to be translated -@@ -2335,7 +2340,7 @@ proc makewindow {} { +@@ -2407,7 +2412,7 @@ proc makewindow {} { -command gotocommit -width 8 $sha1but conf -disabledforeground [$sha1but cget -foreground] pack .tf.bar.sha1label -side left @@ -141,7 +141,7 @@ trace add variable sha1string write sha1change pack $sha1entry -side left -pady 2 -@@ -4062,6 +4067,7 @@ proc stopblaming {} { +@@ -4132,6 +4137,7 @@ proc stopblaming {} { proc read_line_source {fd inst} { global blamestuff curview commfd blameinst nullid nullid2 @@ -149,7 +149,7 @@ while {[gets $fd line] >= 0} { lappend blamestuff($inst) $line -@@ -4082,7 +4088,7 @@ proc read_line_source {fd inst} { +@@ -4152,7 +4158,7 @@ proc read_line_source {fd inst} { set line [split [lindex $blamestuff($inst) 0] " "] set id [lindex $line 0] set lnum [lindex $line 1] @@ -158,7 +158,7 @@ [string is digit -strict $lnum]} { # look for "filename" line foreach l $blamestuff($inst) { -@@ -5226,11 +5232,13 @@ proc askrelhighlight {row id} { +@@ -5296,11 +5302,13 @@ proc askrelhighlight {row id} { # Graph layout functions proc shortids {ids} { @@ -173,7 +173,7 @@ lappend res [string range $id 0 7] } else { lappend res $id -@@ -5405,13 +5413,14 @@ proc get_viewmainhead {view} { +@@ -5475,13 +5483,14 @@ proc get_viewmainhead {view} { # git rev-list should give us just 1 line to use as viewmainheadid($view) proc getviewhead {fd inst view} { global viewmainheadid commfd curview viewinstances showlocalchanges @@ -189,7 +189,7 @@ set id $line } set viewmainheadid($view) $id -@@ -7175,10 +7184,11 @@ proc commit_descriptor {p} { +@@ -7245,10 +7254,11 @@ proc commit_descriptor {p} { # Also look for URLs of the form "http[s]://..." and make them web links. proc appendwithlinks {text tags} { global ctext linknum curview @@ -202,7 +202,7 @@ foreach l $links { set s [lindex $l 0] set e [lindex $l 1] -@@ -7206,13 +7216,14 @@ proc appendwithlinks {text tags} { +@@ -7276,13 +7286,14 @@ proc appendwithlinks {text tags} { proc setlink {id lk} { global curview ctext pendinglinks global linkfgcolor @@ -218,7 +218,7 @@ set matches [longid $id] if {[llength $matches] > 0} { if {[llength $matches] > 1} return -@@ -8857,13 +8868,16 @@ proc incrfont {inc} { +@@ -8927,13 +8938,16 @@ proc incrfont {inc} { proc clearsha1 {} { global sha1entry sha1string @@ -236,7 +236,7 @@ if {$sha1string == {} || ([info exists currentid] && $sha1string == $currentid)} { set state disabled -@@ -8880,6 +8894,7 @@ proc sha1change {n1 n2 op} { +@@ -8950,6 +8964,7 @@ proc sha1change {n1 n2 op} { proc gotocommit {} { global sha1string tagids headids curview varcid @@ -244,7 +244,7 @@ if {$sha1string == {} || ([info exists currentid] && $sha1string == $currentid)} return -@@ -8889,7 +8904,7 @@ proc gotocommit {} { +@@ -8959,7 +8974,7 @@ proc gotocommit {} { set id $headids($sha1string) } else { set id [string tolower $sha1string] @@ -253,7 +253,7 @@ set matches [longid $id] if {$matches ne {}} { if {[llength $matches] > 1} { -@@ -9378,6 +9393,7 @@ proc doseldiff {oldid newid} { +@@ -9446,6 +9461,7 @@ proc doseldiff {oldid newid} { proc mkpatch {} { global rowmenuid currentid commitinfo patchtop patchnum NS @@ -261,7 +261,7 @@ if {![info exists currentid]} return set oldid $currentid -@@ -9392,7 +9408,7 @@ proc mkpatch {} { +@@ -9460,7 +9476,7 @@ proc mkpatch {} { ${NS}::label $top.title -text [mc "Generate patch"] grid $top.title - -pady 10 ${NS}::label $top.from -text [mc "From:"] @@ -270,7 +270,7 @@ $top.fromsha1 insert 0 $oldid $top.fromsha1 conf -state readonly grid $top.from $top.fromsha1 -sticky w -@@ -9401,7 +9417,7 @@ proc mkpatch {} { +@@ -9469,7 +9485,7 @@ proc mkpatch {} { $top.fromhead conf -state readonly grid x $top.fromhead -sticky w ${NS}::label $top.to -text [mc "To:"] @@ -279,7 +279,7 @@ $top.tosha1 insert 0 $newid $top.tosha1 conf -state readonly grid $top.to $top.tosha1 -sticky w -@@ -9470,6 +9486,7 @@ proc mkpatchcan {} { +@@ -9535,6 +9551,7 @@ proc mkpatchcan {} { proc mktag {} { global rowmenuid mktagtop commitinfo NS @@ -287,7 +287,7 @@ set top .maketag set mktagtop $top -@@ -9479,7 +9496,7 @@ proc mktag {} { +@@ -9544,7 +9561,7 @@ proc mktag {} { ${NS}::label $top.title -text [mc "Create tag"] grid $top.title - -pady 10 ${NS}::label $top.id -text [mc "ID:"] @@ -296,7 +296,7 @@ $top.sha1 insert 0 $rowmenuid $top.sha1 conf -state readonly grid $top.id $top.sha1 -sticky w -@@ -9587,10 +9604,11 @@ proc mktaggo {} { +@@ -9652,10 +9669,11 @@ proc mktaggo {} { proc copyreference {} { global rowmenuid autosellen @@ -308,8 +308,8 @@ + if {$autosellen < $hashlength} { lappend cmd --abbrev=$autosellen } - set reference [eval exec $cmd $rowmenuid] -@@ -9601,6 +9619,7 @@ proc copyreference {} { + set reference [safe_exec [concat $cmd $rowmenuid]] +@@ -9666,6 +9684,7 @@ proc copyreference {} { proc writecommit {} { global rowmenuid wrcomtop commitinfo wrcomcmd NS @@ -317,7 +317,7 @@ set top .writecommit set wrcomtop $top -@@ -9610,7 +9629,7 @@ proc writecommit {} { +@@ -9675,7 +9694,7 @@ proc writecommit {} { ${NS}::label $top.title -text [mc "Write commit to file"] grid $top.title - -pady 10 ${NS}::label $top.id -text [mc "ID:"] @@ -326,7 +326,7 @@ $top.sha1 insert 0 $rowmenuid $top.sha1 conf -state readonly grid $top.id $top.sha1 -sticky w -@@ -9690,6 +9709,7 @@ proc mvbranch {} { +@@ -9755,6 +9774,7 @@ proc mvbranch {} { proc branchdia {top valvar uivar} { global NS commitinfo @@ -334,7 +334,7 @@ upvar $valvar val $uivar ui catch {destroy $top} -@@ -9698,7 +9718,7 @@ proc branchdia {top valvar uivar} { +@@ -9763,7 +9783,7 @@ proc branchdia {top valvar uivar} { ${NS}::label $top.title -text $ui(title) grid $top.title - -pady 10 ${NS}::label $top.id -text [mc "ID:"] @@ -343,7 +343,7 @@ $top.sha1 insert 0 $val(id) $top.sha1 conf -state readonly grid $top.id $top.sha1 -sticky w -@@ -9708,7 +9728,7 @@ proc branchdia {top valvar uivar} { +@@ -9773,7 +9793,7 @@ proc branchdia {top valvar uivar} { grid x $top.head -sticky ew grid columnconfigure $top 1 -weight 1 ${NS}::label $top.nlab -text [mc "Name:"] @@ -352,7 +352,7 @@ $top.name insert 0 $val(name) grid $top.nlab $top.name -sticky w ${NS}::frame $top.buts -@@ -11697,6 +11717,7 @@ proc prefspage_general {notebook} { +@@ -11762,6 +11782,7 @@ proc prefspage_general {notebook} { global tabstop wrapcomment wrapdefault limitdiffs global autocopy autoselect autosellen extdifftool perfile_attrs global hideremotes want_ttk have_ttk maxrefs web_browser @@ -360,7 +360,7 @@ set page [create_prefs_page $notebook.general] -@@ -11725,7 +11746,8 @@ proc prefspage_general {notebook} { +@@ -11790,7 +11811,8 @@ proc prefspage_general {notebook} { -variable autoselect grid x $page.autoselect -sticky w } @@ -370,7 +370,7 @@ ${NS}::label $page.autosellenl -text [mc "Length of commit ID to copy"] grid x $page.autosellenl $page.autosellen -sticky w -@@ -12491,6 +12513,17 @@ if {$tclencoding == {}} { +@@ -12556,6 +12578,17 @@ if {$tclencoding == {}} { puts stderr "Warning: encoding $gitencoding is not supported by Tcl/Tk" } @@ -388,7 +388,7 @@ set gui_encoding [encoding system] catch { set enc [exec git config --get gui.encoding] -@@ -12545,7 +12578,7 @@ set limitdiffs 1 +@@ -12610,7 +12643,7 @@ set limitdiffs 1 set datetimeformat "%Y-%m-%d %H:%M:%S" set autocopy 0 set autoselect 1 @@ -397,7 +397,4 @@ set perfile_attrs 0 set want_ttk 1 --- -2.49.0 - ++++++ 0002-git-gui-Add-support-of-SHA256-repo.patch ++++++ --- /var/tmp/diff_new_pack.pzPDY1/_old 2025-07-10 23:14:57.540315514 +0200 +++ /var/tmp/diff_new_pack.pzPDY1/_new 2025-07-10 23:14:57.580317181 +0200 @@ -16,11 +16,11 @@ git-gui/lib/remote_branch_delete.tcl | 4 +++- 5 files changed, 31 insertions(+), 9 deletions(-) -diff --git a/git-gui/git-gui.sh b/git-gui/git-gui.sh -index 28572c889c0e..206981190535 100755 ---- a/git-gui/git-gui.sh -+++ b/git-gui/git-gui.sh -@@ -1275,6 +1275,17 @@ if {[catch { +Index: git/git-gui/git-gui.sh +=================================================================== +--- git.orig/git-gui/git-gui.sh ++++ git/git-gui/git-gui.sh +@@ -1298,6 +1298,17 @@ if {[catch { set picked 1 } @@ -38,7 +38,7 @@ # we expand the _gitdir when it's just a single dot (i.e. when we're being # run from the .git dir itself) lest the routines to find the worktree # get confused -@@ -1822,7 +1833,7 @@ proc short_path {path} { +@@ -1845,7 +1856,7 @@ proc short_path {path} { } set next_icon_id 0 @@ -47,10 +47,10 @@ proc merge_state {path new_state {head_info {}} {index_info {}}} { global file_states next_icon_id null_sha1 -diff --git a/git-gui/lib/blame.tcl b/git-gui/lib/blame.tcl -index 8441e109be32..1f0b8ea28504 100644 ---- a/git-gui/lib/blame.tcl -+++ b/git-gui/lib/blame.tcl +Index: git/git-gui/lib/blame.tcl +=================================================================== +--- git.orig/git-gui/lib/blame.tcl ++++ git/git-gui/lib/blame.tcl @@ -426,6 +426,7 @@ method _kill {} { method _load {jump} { @@ -86,7 +86,7 @@ set t [string range $c 0 8]... } elseif {$c eq {}} { set t {Working Directory} -@@ -627,6 +630,7 @@ method _exec_blame {cur_w cur_d options cur_s} { +@@ -627,6 +630,7 @@ method _exec_blame {cur_w cur_d options method _read_blame {fd cur_w cur_d} { upvar #0 $cur_d line_data variable group_colors @@ -112,10 +112,10 @@ set commit_abbr work set commit_type curr_commit } elseif {$cmit eq $commit} { -diff --git a/git-gui/lib/choose_repository.tcl b/git-gui/lib/choose_repository.tcl -index d23abedcb36f..6078b1c7e2c4 100644 ---- a/git-gui/lib/choose_repository.tcl -+++ b/git-gui/lib/choose_repository.tcl +Index: git/git-gui/lib/choose_repository.tcl +=================================================================== +--- git.orig/git-gui/lib/choose_repository.tcl ++++ git/git-gui/lib/choose_repository.tcl @@ -870,6 +870,8 @@ method _do_clone_HEAD {ok} { } @@ -127,14 +127,14 @@ if {$ok} { @@ -879,7 +881,7 @@ method _do_clone_full_end {ok} { if {[file exists [gitdir FETCH_HEAD]]} { - set fd [open [gitdir FETCH_HEAD] r] + set fd [safe_open_file [gitdir FETCH_HEAD] r] while {[gets $fd line] >= 0} { - if {[regexp "^(.{40})\t\t" $line line HEAD]} { + if {[regexp [string map "@@ $hashlength" "^(.{@@})\t\t"] $line line HEAD]} { break } } -@@ -965,6 +967,8 @@ method _do_clone_checkout {HEAD} { +@@ -966,6 +968,8 @@ method _do_clone_checkout {HEAD} { } method _readtree_wait {fd} { @@ -143,7 +143,7 @@ set buf [read $fd] $o_status_op update_meter $buf append readtree_err $buf -@@ -986,7 +990,7 @@ method _readtree_wait {fd} { +@@ -987,7 +991,7 @@ method _readtree_wait {fd} { # -- Run the post-checkout hook. # @@ -152,11 +152,11 @@ [git rev-parse HEAD] 1] if {$fd_ph ne {}} { global pch_error -diff --git a/git-gui/lib/commit.tcl b/git-gui/lib/commit.tcl -index a570f9cdc6a4..7a7394a5c89c 100644 ---- a/git-gui/lib/commit.tcl -+++ b/git-gui/lib/commit.tcl -@@ -348,6 +348,7 @@ proc commit_committree {fd_wt curHEAD msg_p} { +Index: git/git-gui/lib/commit.tcl +=================================================================== +--- git.orig/git-gui/lib/commit.tcl ++++ git/git-gui/lib/commit.tcl +@@ -348,6 +348,7 @@ proc commit_committree {fd_wt curHEAD ms global file_states selected_paths rescan_active global repo_config global env @@ -164,7 +164,7 @@ gets $fd_wt tree_id if {[catch {close $fd_wt} err]} { -@@ -367,7 +368,7 @@ proc commit_committree {fd_wt curHEAD msg_p} { +@@ -367,7 +368,7 @@ proc commit_committree {fd_wt curHEAD ms close $fd_ot if {[string equal -length 5 {tree } $old_tree] @@ -173,10 +173,10 @@ set old_tree [string range $old_tree 5 end] } else { error [mc "Commit %s appears to be corrupt" $PARENT] -diff --git a/git-gui/lib/remote_branch_delete.tcl b/git-gui/lib/remote_branch_delete.tcl -index 5ba9fcadd17f..8ea672479306 100644 ---- a/git-gui/lib/remote_branch_delete.tcl -+++ b/git-gui/lib/remote_branch_delete.tcl +Index: git/git-gui/lib/remote_branch_delete.tcl +=================================================================== +--- git.orig/git-gui/lib/remote_branch_delete.tcl ++++ git/git-gui/lib/remote_branch_delete.tcl @@ -323,6 +323,8 @@ method _load {cache uri} { } @@ -195,7 +195,4 @@ if {[regsub ^refs/heads/ $ref {} abr]} { lappend head_list $abr lappend head_cache($cache) $abr --- -2.50.0 - ++++++ git-2.50.0.tar.xz -> git-2.50.1.tar.xz ++++++ /work/SRC/openSUSE:Factory/git/git-2.50.0.tar.xz /work/SRC/openSUSE:Factory/.git.new.7373/git-2.50.1.tar.xz differ: char 15, line 1